# WordPress plugin vulnerabilities in 2026: the worst ones Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins, and found the median time from disclosure to first exploit was… Source: https://webkodingtheme.com/blog/wordpress-plugin-vulnerabilities-2026/ --- WordPress # WordPress plugin vulnerabilities in 2026: the worst ones AÖ Arif Özelci · Published 30 Oct 2026 · 6 min read Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins, and found the median time from disclosure to first exploit was five hours. Here are the critical plugin flaws of 2026 so far — the ones scored 9.8 and the ones attackers have already used — with the versions to update to. ## The numbers - 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% on the year before. - 91% were in plugins, 9% in themes. WordPress core had six, all low priority. - 1,966 were high severity — more than double the previous year. - 46% had no fix available when they were disclosed. - Weighted median time to first exploitation: five hours. - Premium plugins and themes had three times more known exploited vulnerabilities than free ones. Broken access control was the most exploited class. Source: Patchstack, “State of WordPress Security in 2026” (covering 2025 data). The five-hour figure is the one to remember: by the time a vulnerability is in the news, sites that update weekly have already been exposed. ## Exploited in the wild in 2026 Plugin CVE What it allows Affected → fixed Modular DS (40,000+ sites) CVE-2026-23550 Unauthenticated privilege escalation; attackers created rogue “backup” admin accounts from 13 January 2.5.1 and older → 2.5.2; Patchstack advises 2.6.0+, which also fixes CVE-2026-23800 Bricksforge (premium) CVE-2026-85097 Unauthenticated file upload leading to remote code execution; attacks seen from 7 October 3.1.8.9 and older → 3.1.8.10 Both are confirmed exploited by Patchstack, which observed the attacks. No third-party plugin has been added to CISA’s Known Exploited Vulnerabilities catalog in 2025 or 2026 — only WordPress core flaws — so CISA’s list alone will not warn you about plugin attacks. ## Other critical (CVSS 9.8) plugin flaws Plugin CVE What it allows Affected versions Kirki (500,000+ sites) CVE-2026-8206 Unauthenticated account takeover through password reset 6.0.0 – 6.0.6 Breeze Cache (300,000+) CVE-2026-3844 Unauthenticated file upload, only when “Host Files Locally – Gravatars” is enabled 2.4.4 and older Burst Statistics (200,000+) CVE-2026-8181 Authentication bypass leading to admin takeover 3.4.0 – 3.4.1.1 Pods (100,000+) CVE-2026-19598 Authorization bypass leading to privilege escalation 3.3.9 and older → 3.3.9.1 Everest Forms Pro (premium) CVE-2026-3300 PHP code injection through eval(), leading to remote code execution 1.9.12 and older WP Maps Pro (premium) CVE-2026-8732 Unauthenticated creation of admin accounts 6.1.0 and older Scores and affected versions are from the National Vulnerability Database; install counts from WordPress.org on 30 October 2026. Where no fixed version is shown, update to the newest release and read its changelog — and if a premium plugin has had no release since its CVE was published, treat it as unpatched. ## What to do - Turn on auto-updates for plugins (Plugins → Enable auto-updates). Five hours is shorter than any manual update routine. - Premium plugins do not auto-update unless the licence is active. Check that every paid plugin can still reach its update server. - Remove plugins you are not using — deactivated plugins can still be attacked if their files are reachable. - Every few weeks, list your administrator accounts and compare against your team. - Look up your plugins in the Patchstack or NVD databases when a critical flaw is announced, rather than waiting for a newsletter. Every WebKoding plugin is listed with its current version and changelog. [Browse the catalogue](/plugins). Browse the plugins → AÖ Arif Özelci Builds the WebKoding plugins. Answers support himself. Share on X LinkedIn Copy link In this article The numbers Exploited in the wild in 2026 Other critical (CVSS 9.8) plugin flaws What to do Related WordPress security releases in 2026: every fix listed WooCommerce security updates in 2026: what changed PHP2Shell (CVE-2026-109618): what WordPress owners must do